not scored yet ยท published 2026-11-10
Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Weakness: CWE-340
Source: NVD CVE-2026-87755
Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.